Information and Software Technology最新文献_第2页

xPriMES: Explainable reinforcement learning-guided mutation strategy with dual-environment interaction for evading black-box malware detectors 基于双环境交互的可解释强化学习引导突变策略逃避黑盒恶意软件检测器

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2026-01-05 DOI: 10.1016/j.infsof.2026.108019

Phan The Duy, Nguyen Manh Cuong, Ha Trieu Yen Vy, Le Tuan Luong, Nguyen Tran Duc Anh, Nghi Hoang Khoa, Van-Hau Pham

Malware continues to evolve, exposing weaknesses in conventional detectors and motivating realistic adversarial evaluations. Prior RL-based evasion methods often rely on partial model access or feature-level perturbations, limiting realism under strict black-box constraints. We propose xPriMES, a dual-environment reinforcement learning framework that generates functionality-preserving binary mutations for malware evasion in black-box settings. A LightGBM surrogate provides continuous confidence feedback for dense reward shaping, while the real target detector supplies binary feedback — used both for episode termination and for issuing the final reward — ensuring learning remains grounded in real evasion outcomes. The agent employs Thompson sampling and SHAP-guided prioritized replay to focus exploration on feature-relevant mutations and accelerate convergence. Experiments on multiple static detectors (LightGBM, RF+CNN, MalConv, CNN, KNN) demonstrate up to 97.4% evasion success, surpassing PSP-Mal under equivalent conditions. Further tests on VirusTotal confirm the transferability and real-world impact of the adversarial samples. These findings show that integrating explainable guidance with surrogate-assisted RL yields interpretable and effective black-box evasion while preserving functionality. We conclude with implications for defensive hardening and discuss limitations related to surrogate fidelity and the focus on static detection.

恶意软件不断发展，暴露了传统检测器的弱点，并激发了现实的对抗性评估。先前基于强化学习的逃避方法通常依赖于部分模型访问或特征级扰动，在严格的黑盒约束下限制了真实感。我们提出了xPriMES，这是一个双环境强化学习框架，可以生成功能保留的二进制突变，以便在黑盒设置中规避恶意软件。LightGBM代理为密集的奖励形成提供连续的置信度反馈，而真实的目标检测器提供二元反馈——用于插曲终止和发出最终奖励——确保学习仍然基于真实的逃避结果。该智能体采用汤普森采样和shap引导的优先重播，将探索重点放在与特征相关的突变上，加速收敛。在多个静态检测器（LightGBM, RF+CNN, MalConv， CNN， KNN）上的实验表明，在同等条件下，规避成功率高达97.4%，超过了sps - mal。VirusTotal的进一步测试证实了对抗性样本的可转移性和现实世界的影响。这些发现表明，将可解释的指导与代理辅助RL相结合，可以在保留功能的同时产生可解释和有效的黑匣子规避。我们总结了防御强化的含义，并讨论了与代理保真度和静态检测相关的限制。

{"title":"xPriMES: Explainable reinforcement learning-guided mutation strategy with dual-environment interaction for evading black-box malware detectors","authors":"Phan The Duy, Nguyen Manh Cuong, Ha Trieu Yen Vy, Le Tuan Luong, Nguyen Tran Duc Anh, Nghi Hoang Khoa, Van-Hau Pham","doi":"10.1016/j.infsof.2026.108019","DOIUrl":"10.1016/j.infsof.2026.108019","url":null,"abstract":"<div><div>Malware continues to evolve, exposing weaknesses in conventional detectors and motivating realistic adversarial evaluations. Prior RL-based evasion methods often rely on partial model access or feature-level perturbations, limiting realism under strict black-box constraints. We propose xPriMES, a dual-environment reinforcement learning framework that generates functionality-preserving binary mutations for malware evasion in black-box settings. A LightGBM surrogate provides continuous confidence feedback for dense reward shaping, while the real target detector supplies binary feedback — used both for episode termination and for issuing the final reward — ensuring learning remains grounded in real evasion outcomes. The agent employs Thompson sampling and SHAP-guided prioritized replay to focus exploration on feature-relevant mutations and accelerate convergence. Experiments on multiple static detectors (LightGBM, RF+CNN, MalConv, CNN, KNN) demonstrate up to 97.4% evasion success, surpassing PSP-Mal under equivalent conditions. Further tests on VirusTotal confirm the transferability and real-world impact of the adversarial samples. These findings show that integrating explainable guidance with surrogate-assisted RL yields interpretable and effective black-box evasion while preserving functionality. We conclude with implications for defensive hardening and discuss limitations related to surrogate fidelity and the focus on static detection.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108019"},"PeriodicalIF":4.3,"publicationDate":"2026-01-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145928208","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CSVD-AES: Cross-project software vulnerability detection based on active learning with metric fusion CSVD-AES：基于主动学习和度量融合的跨项目软件漏洞检测

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2026-01-05 DOI: 10.1016/j.infsof.2026.108015

Zhidan Yuan , Xiang Chen , Juan Zhang , Weiming Zeng

Context:

Previous studies on Cross-Project Software Vulnerability Detection (CSVD) have shown that leveraging a small number of labeled modules from the target project can enhance the performance of CSVD. However, how to systematically select representative modules for labeling has not received sufficient attention. In addition, program modules can be measured using either expert or semantic metrics. There has been insufficient attention given to whether considering both metrics simultaneously helps in selecting representative modules.

Objective:

To address these challenges, we introduce a novel approach CSVD-AES. This method aims to fuse expert and semantic metrics and employs the active learning to select the most representative modules for labeling.

Methods:

CSVD-AES consists of three phases: the code representation phase, the active learning phase, and the model construction phase. In the code representation phase, a self-attention mechanism is used to fuse the metrics. In the active learning phase, an uncertainty sampling strategy is employed to select the most representative modules for labeling. In the model construction phase, the weighted cross-entropy (WCE) loss function is applied to address the class imbalance issue in the labeled modules. The metric fusion helps active learning identify representative modules. Since selecting modules can exacerbate the class imbalance issue in the labeled modules, we employ a sampling balancing strategy during the active learning phase to address this problem.

Results:

CSVD-AES is evaluated through a comprehensive study on four real-world projects. The results demonstrate that CSVD-AES outperforms five state-of-the-art baselines, achieving AUC improvements ranging from 4.0% to 24.4%. A series of ablation experiments verify the rationality of the CSVD-AES component settings.

Conclusion:

CSVD-AES effectively addresses the challenges in the field of CSVD by combining active learning and metric fusion, significantly advancing the development of this field.

背景：先前关于跨项目软件漏洞检测（CSVD）的研究表明，利用目标项目中的少量标记模块可以提高CSVD的性能。然而，如何系统地选择有代表性的模块进行标注却没有得到足够的重视。此外，程序模块可以使用专家或语义度量来度量。同时考虑这两个指标是否有助于选择有代表性的模块，这一点一直没有得到足够的重视。目的：为了解决这些挑战，我们引入了一种新的方法CSVD-AES。该方法旨在融合专家指标和语义指标，采用主动学习选择最具代表性的模块进行标注。方法：CSVD-AES包括三个阶段：代码表示阶段、主动学习阶段和模型构建阶段。在代码表示阶段，使用自关注机制来融合度量。在主动学习阶段，采用不确定性采样策略选择最具代表性的模块进行标注。在模型构建阶段，采用加权交叉熵（WCE）损失函数来解决标记模块中的类不平衡问题。度量融合有助于主动学习识别有代表性的模块。由于选择模块会加剧标记模块中的类不平衡问题，我们在主动学习阶段采用抽样平衡策略来解决这个问题。结果：通过对四个实际项目的综合研究，对CSVD-AES进行了评价。结果表明，CSVD-AES优于5个最先进的基线，实现了4.0%至24.4%的AUC改进。一系列烧蚀实验验证了CSVD-AES组件设置的合理性。结论：CSVD- aes结合主动学习和度量融合，有效解决了CSVD领域面临的挑战，显著推进了该领域的发展。

{"title":"CSVD-AES: Cross-project software vulnerability detection based on active learning with metric fusion","authors":"Zhidan Yuan , Xiang Chen , Juan Zhang , Weiming Zeng","doi":"10.1016/j.infsof.2026.108015","DOIUrl":"10.1016/j.infsof.2026.108015","url":null,"abstract":"<div><h3>Context:</h3><div>Previous studies on Cross-Project Software Vulnerability Detection (CSVD) have shown that leveraging a small number of labeled modules from the target project can enhance the performance of CSVD. However, how to systematically select representative modules for labeling has not received sufficient attention. In addition, program modules can be measured using either expert or semantic metrics. There has been insufficient attention given to whether considering both metrics simultaneously helps in selecting representative modules.</div></div><div><h3>Objective:</h3><div>To address these challenges, we introduce a novel approach CSVD-AES. This method aims to fuse expert and semantic metrics and employs the active learning to select the most representative modules for labeling.</div></div><div><h3>Methods:</h3><div>CSVD-AES consists of three phases: the code representation phase, the active learning phase, and the model construction phase. In the code representation phase, a self-attention mechanism is used to fuse the metrics. In the active learning phase, an uncertainty sampling strategy is employed to select the most representative modules for labeling. In the model construction phase, the weighted cross-entropy (WCE) loss function is applied to address the class imbalance issue in the labeled modules. The metric fusion helps active learning identify representative modules. Since selecting modules can exacerbate the class imbalance issue in the labeled modules, we employ a sampling balancing strategy during the active learning phase to address this problem.</div></div><div><h3>Results:</h3><div>CSVD-AES is evaluated through a comprehensive study on four real-world projects. The results demonstrate that CSVD-AES outperforms five state-of-the-art baselines, achieving AUC improvements ranging from 4.0% to 24.4%. A series of ablation experiments verify the rationality of the CSVD-AES component settings.</div></div><div><h3>Conclusion:</h3><div>CSVD-AES effectively addresses the challenges in the field of CSVD by combining active learning and metric fusion, significantly advancing the development of this field.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108015"},"PeriodicalIF":4.3,"publicationDate":"2026-01-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145928338","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Automatic multi-language analysis of SOLID compliance via machine learning algorithms 通过机器学习算法对SOLID遵从性进行自动多语言分析

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2026-01-05 DOI: 10.1016/j.infsof.2026.108013

Caner Balim , Naim Karasekreter , Özkan Aslan

Context

The SOLID design principles are fundamental in object-oriented software development, promoting modularity, maintainability, and scalability. Manual verification of these principles in code is often time-consuming and error-prone, especially in large-scale, multilingual projects. Since adherence to SOLID principles is closely linked to software quality, automating this verification can significantly enhance code reliability.

Objectives

This study proposes a machine learning-based approach for the automatic classification of SOLID principle compliance in object-oriented code. Specifically, we investigate the effectiveness of embedding representations generated by three pretrained transformer models: LongCoder and StarCoder2, which are both code-oriented, and BigBird, a general-purpose model, in supporting principle-specific classification across Java and Python codebases.

Methods

We compiled a novel multi-label dataset consisting of 1103 real-world multi-class code units in Java and Python, annotated for compliance with five SOLID principles. Feature embeddings were extracted using the three transformer models. These embeddings were input to six different classifiers per principle. We evaluated model performance using stratified 5-fold cross-validation and reported accuracy, precision, recall, and F1 scores.

Results

Principles with well-defined structural characteristics, such as Interface Segregation (ISP) and Dependency Inversion (DIP), achieved high F1 scores (>90%). Semantically complex principles like Single Responsibility (SRP) and Liskov Substitution (LSP) yielded lower F1 scores (∼70–75%). Among the models, StarCoder2 combined with Multi-Layer Perceptron (MLP) consistently outperformed others across both Java and Python datasets. Statistical analyses confirmed that these performance differences are significant. Furthermore, comparisons with open-source large language models (DeepSeek-Coder-V2 and CodeLlama) demonstrated that the approach yields more stable and interpretable results across all principles.

Conclusion

Machine learning models leveraging code-specific embeddings can accurately identify structurally explicit SOLID principles. Code-oriented transformers such as StarCoder2 and LongCoder outperformed the general-purpose model BigBird, especially for principles requiring nuanced semantic understanding. Beyond its experimental contributions, the study provides practical value by enabling automated design-principle assessment in large codebases, reducing manual inspection effort, and offering a foundation for integration into software quality assurance tools and continuous integration pipelines.

SOLID设计原则是面向对象软件开发的基础，促进模块化、可维护性和可伸缩性。在代码中手工验证这些原则通常是耗时且容易出错的，特别是在大型、多语言的项目中。由于对SOLID原则的遵守与软件质量密切相关，因此自动化验证可以显著提高代码的可靠性。目的提出一种基于机器学习的面向对象代码中SOLID原则遵从性自动分类方法。具体来说，我们研究了由三个预训练的转换模型生成的嵌入表示的有效性：LongCoder和StarCoder2都是面向代码的，BigBird是一个通用模型，支持跨Java和Python代码库的特定原则分类。方法编译了一个新的多标签数据集，该数据集由1103个真实世界的Java和Python多类代码单元组成，并根据五个SOLID原则进行了注释。利用三种变压器模型提取特征嵌入。这些嵌入被输入到六个不同的分类器每个原则。我们使用分层5倍交叉验证评估模型性能，并报告准确性、精密度、召回率和F1分数。结果界面隔离（ISP）和依赖反转（DIP）等具有明确结构特征的原则获得了较高的F1分数（>90%）。语义复杂的原则，如单一责任（SRP）和Liskov替代（LSP）产生较低的F1分数（~ 70-75%）。在这些模型中，StarCoder2结合多层感知器（MLP）在Java和Python数据集上的表现始终优于其他模型。统计分析证实，这些性能差异是显著的。此外，与开源大型语言模型（deepseek - code - v2和CodeLlama）的比较表明，该方法在所有原则下产生更稳定和可解释的结果。利用代码特定嵌入的机器学习模型可以准确识别结构明确的SOLID原则。面向代码的转换器，如StarCoder2和LongCoder，优于通用模型BigBird，特别是对于需要细微语义理解的原则。除了它的实验贡献之外，该研究通过在大型代码库中实现自动设计原则评估，减少人工检查工作，并为集成到软件质量保证工具和持续集成管道中提供了基础，从而提供了实用价值。

{"title":"Automatic multi-language analysis of SOLID compliance via machine learning algorithms","authors":"Caner Balim , Naim Karasekreter , Özkan Aslan","doi":"10.1016/j.infsof.2026.108013","DOIUrl":"10.1016/j.infsof.2026.108013","url":null,"abstract":"<div><h3>Context</h3><div>The SOLID design principles are fundamental in object-oriented software development, promoting modularity, maintainability, and scalability. Manual verification of these principles in code is often time-consuming and error-prone, especially in large-scale, multilingual projects. Since adherence to SOLID principles is closely linked to software quality, automating this verification can significantly enhance code reliability.</div></div><div><h3>Objectives</h3><div>This study proposes a machine learning-based approach for the automatic classification of SOLID principle compliance in object-oriented code. Specifically, we investigate the effectiveness of embedding representations generated by three pretrained transformer models: LongCoder and StarCoder2, which are both code-oriented, and BigBird, a general-purpose model, in supporting principle-specific classification across Java and Python codebases.</div></div><div><h3>Methods</h3><div>We compiled a novel multi-label dataset consisting of 1103 real-world multi-class code units in Java and Python, annotated for compliance with five SOLID principles. Feature embeddings were extracted using the three transformer models. These embeddings were input to six different classifiers per principle. We evaluated model performance using stratified 5-fold cross-validation and reported accuracy, precision, recall, and F1 scores.</div></div><div><h3>Results</h3><div>Principles with well-defined structural characteristics, such as Interface Segregation (ISP) and Dependency Inversion (DIP), achieved high F1 scores (>90%). Semantically complex principles like Single Responsibility (SRP) and Liskov Substitution (LSP) yielded lower F1 scores (∼70–75%). Among the models, StarCoder2 combined with Multi-Layer Perceptron (MLP) consistently outperformed others across both Java and Python datasets. Statistical analyses confirmed that these performance differences are significant. Furthermore, comparisons with open-source large language models (DeepSeek-Coder-V2 and CodeLlama) demonstrated that the approach yields more stable and interpretable results across all principles.</div></div><div><h3>Conclusion</h3><div>Machine learning models leveraging code-specific embeddings can accurately identify structurally explicit SOLID principles. Code-oriented transformers such as StarCoder2 and LongCoder outperformed the general-purpose model BigBird, especially for principles requiring nuanced semantic understanding. Beyond its experimental contributions, the study provides practical value by enabling automated design-principle assessment in large codebases, reducing manual inspection effort, and offering a foundation for integration into software quality assurance tools and continuous integration pipelines.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108013"},"PeriodicalIF":4.3,"publicationDate":"2026-01-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145928206","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A study on functionality validation for windows malware mutating using reinforcement learning 基于强化学习的windows恶意软件变异功能验证研究

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2026-01-02 DOI: 10.1016/j.infsof.2025.108008

Do Thi Thu Hien , Le Viet Tai Man , Le Trong Nhan , Phan Ngoc Yen Nhi , Hoang Thanh Lam , Nguyen Tan Cam , Van-Hau Pham

Context:

To keep pace with the rapid advancements in both the quality and complexity of malware, recent research has extensively employed machine learning (ML) and deep learning (DL) models to detect malicious software, particularly in the widely used Windows system. Despite demonstrating promising accuracy in identifying malware, these models remain vulnerable to adversarial attacks, where carefully modified malware samples can bypass detection. Consequently, there is a growing need to generate mutated malware by altering existing samples to comprehensively assess the robustness of ML/DL-based detectors. Unlike in the field of computer vision, functionality validation plays a crucial role in evaluating the effectiveness of these modified malware samples. Even if they achieve high evasion rates, any corruption in file format or execution can make them ineffective.

Objective:

To address this, we consider the essentials of functionality validation in creating malware samples by designing validators that can be used in reinforcement learning-based Windows malware mutation. Our focus is on workable and useful adversarial samples rather than the quantity.

Method:

Two different functionality validation methods are proposed, leveraging the static and dynamic analysis processes of PE files to capture the representation of their behaviors to verify the preservation of designed functionalities. They are then integrated into the RL framework to support the agent in recognizing actions that can cause broken samples.

Results:

Whether employing static or dynamic analysis for validation, the experimental results confirm that the proposed methods successfully maintain the original behavior of malware while enhancing its ability to evade ML-based detectors. Compared to other approaches, although the number of created adversarial malware drops due to stricter validation, a higher ratio of them are confirmed functionality-preserved.

Conclusions:

Functionality validation is an essential task in creating Windows malware mutants to ensure their reliability and usability in further assessment scenarios or real-life attacks.

背景：为了跟上恶意软件质量和复杂性的快速发展，最近的研究广泛使用机器学习（ML）和深度学习（DL）模型来检测恶意软件，特别是在广泛使用的Windows系统中。尽管证明了识别恶意软件的准确性，但这些模型仍然容易受到对抗性攻击，在对抗性攻击中，精心修改的恶意软件样本可以绕过检测。因此，越来越需要通过改变现有样本来生成突变恶意软件，以全面评估基于ML/ dl的检测器的鲁棒性。与计算机视觉领域不同，功能验证在评估这些修改后的恶意软件样本的有效性方面起着至关重要的作用。即使它们实现了很高的逃避率，文件格式或执行中的任何损坏都可能使它们无效。目的：为了解决这个问题，我们通过设计可用于基于强化学习的Windows恶意软件突变的验证器，考虑了在创建恶意软件样本时功能验证的要点。我们的重点是可行和有用的对抗性样本，而不是数量。方法：提出了两种不同的功能验证方法，利用PE文件的静态和动态分析过程来捕获其行为的表示，以验证设计功能的保存。然后将它们集成到RL框架中，以支持代理识别可能导致破坏样本的操作。结果：无论是采用静态分析还是动态分析进行验证，实验结果都证实了所提出的方法成功地保持了恶意软件的原始行为，同时增强了其逃避基于ml的检测器的能力。与其他方法相比，尽管创建的对抗性恶意软件的数量由于更严格的验证而减少，但它们中确认功能保留的比例更高。结论：功能验证是创建Windows恶意软件突变体的基本任务，以确保其在进一步评估场景或实际攻击中的可靠性和可用性。

{"title":"A study on functionality validation for windows malware mutating using reinforcement learning","authors":"Do Thi Thu Hien , Le Viet Tai Man , Le Trong Nhan , Phan Ngoc Yen Nhi , Hoang Thanh Lam , Nguyen Tan Cam , Van-Hau Pham","doi":"10.1016/j.infsof.2025.108008","DOIUrl":"10.1016/j.infsof.2025.108008","url":null,"abstract":"<div><h3>Context:</h3><div>To keep pace with the rapid advancements in both the quality and complexity of malware, recent research has extensively employed machine learning (ML) and deep learning (DL) models to detect malicious software, particularly in the widely used Windows system. Despite demonstrating promising accuracy in identifying malware, these models remain vulnerable to adversarial attacks, where carefully modified malware samples can bypass detection. Consequently, there is a growing need to generate mutated malware by altering existing samples to comprehensively assess the robustness of ML/DL-based detectors. Unlike in the field of computer vision, functionality validation plays a crucial role in evaluating the effectiveness of these modified malware samples. Even if they achieve high evasion rates, any corruption in file format or execution can make them ineffective.</div></div><div><h3>Objective:</h3><div>To address this, we consider the essentials of functionality validation in creating malware samples by designing validators that can be used in reinforcement learning-based Windows malware mutation. Our focus is on workable and useful adversarial samples rather than the quantity.</div></div><div><h3>Method:</h3><div>Two different functionality validation methods are proposed, leveraging the static and dynamic analysis processes of PE files to capture the representation of their behaviors to verify the preservation of designed functionalities. They are then integrated into the RL framework to support the agent in recognizing actions that can cause broken samples.</div></div><div><h3>Results:</h3><div>Whether employing static or dynamic analysis for validation, the experimental results confirm that the proposed methods successfully maintain the original behavior of malware while enhancing its ability to evade ML-based detectors. Compared to other approaches, although the number of created adversarial malware drops due to stricter validation, a higher ratio of them are confirmed functionality-preserved.</div></div><div><h3>Conclusions:</h3><div>Functionality validation is an essential task in creating Windows malware mutants to ensure their reliability and usability in further assessment scenarios or real-life attacks.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108008"},"PeriodicalIF":4.3,"publicationDate":"2026-01-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145928335","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Gated transformer network for multivariate security patch identification with mixture-of-experts 基于混合专家的门控变压器网络多变量安全补丁识别

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-31 DOI: 10.1016/j.infsof.2025.108006

Jiajun Tong , Zhixiao Wang , Xiaobin Rui

Context:

Security patch identification is an important task in continuous integration and deployment, which helps software developers detect security issues and code vulnerabilities. Recent studies have confirmed that using both commit message and code diff information are beneficial to identification performance. However, existing works still face the problems of poor model representation ability and low model robustness, both of which affect the quality of commit representation, resulting in bad identification performance.

Objective:

We propose a gated transformer network for multivariate security patch identification with mixture-of-experts.

Method:

To improve the representation capability of the model and the quality of the commit representations, we provided a bi-encoder to utilize prior knowledge to enhance distinctive features for commit message and code diff respectively. To improve the robustness of the model and further improve the quality of commit representations, we designed a gated layer to learn the weight of each expert, and dynamically assign weights to different features.

Results:

Extensive experiments show that our framework has effectively improved the model representation ability, and the robustness of the model, providing high-quality commit representations, and achieves the state-of-the-art performance.

Conclusion:

Our approach provides a bi-encoder to obtain the embedding of each feature by two experts, and then explore the difference between them, by setting different weights through the gated layer. It not only improves the model representation ability but also improves the robustness of the model, thus having favorable applicability in real-world scenarios. The code and data are shared in https://github.com/AppleMax1992/ensemble_commit.

背景：安全补丁识别是持续集成和部署中的一项重要任务，它可以帮助软件开发人员发现安全问题和代码漏洞。最近的研究已经证实，同时使用提交消息和代码差异信息有助于提高识别性能。然而，现有的工作仍然面临着模型表示能力差和模型鲁棒性低等问题，这些问题都会影响提交表示的质量，导致识别性能不佳。目的：提出一种基于混合专家的多变量安全补丁识别的门控变压器网络。方法：为了提高模型的表示能力和提交表示的质量，我们提供了一个双编码器，利用先验知识分别增强提交消息和代码差异的显著特征。为了提高模型的鲁棒性和进一步提高提交表示的质量，我们设计了一个门控层来学习每个专家的权重，并动态地为不同的特征分配权重。结果：大量的实验表明，我们的框架有效地提高了模型的表示能力和模型的鲁棒性，提供了高质量的提交表示，达到了最先进的性能。结论：我们的方法提供了一个双编码器，通过两个专家获得每个特征的嵌入，然后通过门控层设置不同的权重来探索它们之间的差异。它不仅提高了模型的表示能力，而且提高了模型的鲁棒性，因此在实际场景中具有良好的适用性。代码和数据在https://github.com/AppleMax1992/ensemble_commit中共享。

{"title":"Gated transformer network for multivariate security patch identification with mixture-of-experts","authors":"Jiajun Tong , Zhixiao Wang , Xiaobin Rui","doi":"10.1016/j.infsof.2025.108006","DOIUrl":"10.1016/j.infsof.2025.108006","url":null,"abstract":"<div><h3>Context:</h3><div>Security patch identification is an important task in continuous integration and deployment, which helps software developers detect security issues and code vulnerabilities. Recent studies have confirmed that using both commit message and code diff information are beneficial to identification performance. However, existing works still face the problems of poor model representation ability and low model robustness, both of which affect the quality of commit representation, resulting in bad identification performance.</div></div><div><h3>Objective:</h3><div>We propose a gated transformer network for multivariate security patch identification with mixture-of-experts.</div></div><div><h3>Method:</h3><div>To improve the representation capability of the model and the quality of the commit representations, we provided a bi-encoder to utilize prior knowledge to enhance distinctive features for commit message and code diff respectively. To improve the robustness of the model and further improve the quality of commit representations, we designed a gated layer to learn the weight of each expert, and dynamically assign weights to different features.</div></div><div><h3>Results:</h3><div>Extensive experiments show that our framework has effectively improved the model representation ability, and the robustness of the model, providing high-quality commit representations, and achieves the state-of-the-art performance.</div></div><div><h3>Conclusion:</h3><div>Our approach provides a bi-encoder to obtain the embedding of each feature by two experts, and then explore the difference between them, by setting different weights through the gated layer. It not only improves the model representation ability but also improves the robustness of the model, thus having favorable applicability in real-world scenarios. The code and data are shared in <span><span>https://github.com/AppleMax1992/ensemble_commit</span><svg><path></path></svg></span>.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108006"},"PeriodicalIF":4.3,"publicationDate":"2025-12-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145891160","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

VulSEG: Enhanced graph-based vulnerability detection system with advanced text embedding VulSEG：增强的基于图形的漏洞检测系统，具有高级文本嵌入

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-31 DOI: 10.1016/j.infsof.2025.108007

Wenjing Cai , Xin Liu , Lipeng Gao

In the field of software security, the detection of vulnerabilities in source code has become increasingly important. Traditional methods based on feature engineering and statistical models are inefficient when dealing with complex code structures and large-scale data, while deep learning approaches have shown significant potential. Many detection methods involve converting source code into images for analysis. Although scalable, convolutional neural networks often fail to fully comprehend the complex structure and semantic relationships in the code, resulting in inadequate capture of high-level semantic features, which affects the accuracy of detection. This study introduces an innovative vulnerability detection framework, VulSEG, which significantly improves detection accuracy while maintaining high scalability. We combine the Program Dependence Graph (PDG), Control Flow Graph (CFG), and Context Dependency Graph (CDG) to create a context-enhanced graph representation. Additionally, we develop a composite feature encoding strategy that integrates Syntax Tree (AST) encoding with deep semantic security coding (Word2Vec + Complexity- and Security-Weighted TF-IDF, CSW-TF-IDF) to enhance the understanding of code complexity and the accuracy of predicting potential vulnerabilities. By incorporating the Text Convolutional Neural Network (TextCNN) and Bidirectional Long Short-Term Memory (BiLSTM) models, we further enhance feature extraction and long-sequence dependency handling capabilities. The experimental results show that, compared to state-of-the-art methods, our approach improves accuracy by 11.8%.

在软件安全领域，源代码漏洞的检测变得越来越重要。传统的基于特征工程和统计模型的方法在处理复杂的代码结构和大规模数据时效率低下，而深度学习方法显示出巨大的潜力。许多检测方法涉及将源代码转换为图像进行分析。虽然具有可扩展性，但卷积神经网络往往不能完全理解代码中复杂的结构和语义关系，导致无法充分捕获高级语义特征，从而影响检测的准确性。本研究引入了一种创新的漏洞检测框架VulSEG，在保持高可扩展性的同时显著提高了检测精度。我们结合程序依赖图（PDG）、控制流图（CFG）和上下文依赖图（CDG）来创建一个上下文增强的图表示。此外，我们开发了一种复合特征编码策略，该策略将语法树（AST）编码与深度语义安全编码（Word2Vec +复杂性和安全加权TF-IDF， CSW-TF-IDF）集成在一起，以增强对代码复杂性的理解和预测潜在漏洞的准确性。通过结合文本卷积神经网络（TextCNN）和双向长短期记忆（BiLSTM）模型，进一步增强了特征提取和长序列依赖处理能力。实验结果表明，与现有方法相比，该方法的准确率提高了11.8%。

{"title":"VulSEG: Enhanced graph-based vulnerability detection system with advanced text embedding","authors":"Wenjing Cai , Xin Liu , Lipeng Gao","doi":"10.1016/j.infsof.2025.108007","DOIUrl":"10.1016/j.infsof.2025.108007","url":null,"abstract":"<div><div>In the field of software security, the detection of vulnerabilities in source code has become increasingly important. Traditional methods based on feature engineering and statistical models are inefficient when dealing with complex code structures and large-scale data, while deep learning approaches have shown significant potential. Many detection methods involve converting source code into images for analysis. Although scalable, convolutional neural networks often fail to fully comprehend the complex structure and semantic relationships in the code, resulting in inadequate capture of high-level semantic features, which affects the accuracy of detection. This study introduces an innovative vulnerability detection framework, <em>VulSEG</em>, which significantly improves detection accuracy while maintaining high scalability. We combine the <em>Program Dependence Graph (PDG)</em>, <em>Control Flow Graph (CFG)</em>, and <em>Context Dependency Graph (CDG)</em> to create a context-enhanced graph representation. Additionally, we develop a composite feature encoding strategy that integrates <em>Syntax Tree (AST)</em> encoding with deep semantic security coding <em>(Word2Vec + Complexity- and Security-Weighted TF-IDF, CSW-TF-IDF)</em> to enhance the understanding of code complexity and the accuracy of predicting potential vulnerabilities. By incorporating the <em>Text Convolutional Neural Network (TextCNN)</em> and <em>Bidirectional Long Short-Term Memory (BiLSTM)</em> models, we further enhance feature extraction and long-sequence dependency handling capabilities. The experimental results show that, compared to state-of-the-art methods, our approach improves accuracy by 11.8%.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"192 ","pages":"Article 108007"},"PeriodicalIF":4.3,"publicationDate":"2025-12-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145928209","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Compositional security analysis of dynamic component-based systems 基于动态组件的系统组合安全性分析

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-26 DOI: 10.1016/j.infsof.2025.108002

Charilaos Skandylas , Narges Khakpour

Context:

To reason about and enforce security in dynamic software systems, automated analysis and verification approaches are required. However, such approaches often encounter scalability issues, particularly when employed for runtime analysis, which is necessary in software systems with dynamically changing architectures, such as self-adaptive systems.

Objective:

In this work, we propose an automated formal approach for security analysis of component-based systems with dynamic architectures.

Methods:

This approach leverages formal abstraction and incremental analysis techniques to reduce the complexity of runtime analysis. We have implemented and evaluated our approach against ZNN, a widely known self-adaptive system exemplar.

Results:

Compared to the state of the art, our results demonstrate an improvement both in the size of systems that can be analyzed and at the time required to complete the analysis. In particular, our incremental analysis is well suited for systems that alter their architectures at runtime.

Conclusion:

Therefore, this approach is suitable for analyzing the security dynamic component based both statically and at runtime.

上下文：为了对动态软件系统中的安全性进行推理和强制执行，需要使用自动分析和验证方法。然而，这种方法经常遇到可伸缩性问题，特别是在用于运行时分析时，这在具有动态变化体系结构的软件系统中是必要的，例如自适应系统。目的：在这项工作中，我们提出了一种自动化的形式化方法，用于动态架构的基于组件的系统的安全分析。方法：该方法利用形式抽象和增量分析技术来减少运行时分析的复杂性。我们已经针对ZNN（一个广为人知的自适应系统范例）实现并评估了我们的方法。结果：与目前的技术水平相比，我们的结果表明，可以分析的系统的大小和完成分析所需的时间都有所改善。特别是，我们的增量分析非常适合在运行时改变其体系结构的系统。结论：该方法适用于基于静态和运行时的安全动态组件分析。

{"title":"Compositional security analysis of dynamic component-based systems","authors":"Charilaos Skandylas , Narges Khakpour","doi":"10.1016/j.infsof.2025.108002","DOIUrl":"10.1016/j.infsof.2025.108002","url":null,"abstract":"<div><h3>Context:</h3><div>To reason about and enforce security in dynamic software systems, automated analysis and verification approaches are required. However, such approaches often encounter scalability issues, particularly when employed for runtime analysis, which is necessary in software systems with dynamically changing architectures, such as self-adaptive systems.</div></div><div><h3>Objective:</h3><div>In this work, we propose an automated formal approach for security analysis of component-based systems with dynamic architectures.</div></div><div><h3>Methods:</h3><div>This approach leverages formal abstraction and incremental analysis techniques to reduce the complexity of runtime analysis. We have implemented and evaluated our approach against ZNN, a widely known self-adaptive system exemplar.</div></div><div><h3>Results:</h3><div>Compared to the state of the art, our results demonstrate an improvement both in the size of systems that can be analyzed and at the time required to complete the analysis. In particular, our incremental analysis is well suited for systems that alter their architectures at runtime.</div></div><div><h3>Conclusion:</h3><div>Therefore, this approach is suitable for analyzing the security dynamic component based both statically and at runtime.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"191 ","pages":"Article 108002"},"PeriodicalIF":4.3,"publicationDate":"2025-12-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884035","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Maximizing quantum hardware utilization via multiprogramming circuits and shot-wise distribution 通过多路编程电路和单点分布最大化量子硬件利用率

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-20 DOI: 10.1016/j.infsof.2025.108005

Giuseppe Bisicchia , Jaime Alvarado-Valiente , Javier Romero-Álvarez , Jose Garcia-Alonso , Juan M. Murillo , Antonio Brogi

Context:

Quantum computing is rapidly evolving, offering new opportunities for solving problems in optimization, cryptography, and simulation. However, the limited availability of quantum resources makes efficient utilization of quantum hardware a current challenge. Today’s paradigms often lead to under-utilization of qubits, increased costs, and execution delays, especially in the NISQ era.

Objective:

This work aims to improve the utilization of quantum hardware by introducing an execution model that integrates multiprogramming at circuit level with quantum shot-wise distribution in a single policy-driven pipeline.

Methods:

An architecture has been implemented that combines circuit scheduling and shot distribution techniques to aggregate multiple circuits and distribute their shots across heterogeneous QPUs. The approach was empirically validated on actual IBM Quantum devices using a diverse set of reference circuits.

Results:

The proposal achieved a reduction in cost of 95% and a reduction in tasks 92%. Moreover, the fidelity analysis of the results showed an increase in noise, with an average increase of approximately 20% using different statistical distances.

Conclusions:

This research provides a usable and extensible solution to increase the efficiency, cost effectiveness, and resilience of quantum workload execution in heterogeneous and dynamic cloud environments. These results obtained suggest that users should weigh the implications of fidelity versus cost (and time) savings based on the application requirements and their goals.

背景：量子计算正在迅速发展，为解决优化、密码学和模拟方面的问题提供了新的机会。然而，量子资源的有限可用性使得量子硬件的有效利用成为当前的挑战。今天的范例经常导致量子位利用率不足、成本增加和执行延迟，特别是在NISQ时代。目的：本工作旨在通过引入一种执行模型来提高量子硬件的利用率，该模型在单个策略驱动的管道中集成了电路级的多编程和量子shot-wise分布。方法：实现了一种结合电路调度和镜头分配技术的体系结构，以聚合多个电路并将其镜头分布在异构qpu上。该方法在实际的IBM量子设备上使用多种参考电路进行了经验验证。结果：该方案成本降低95%，任务减少92%。此外，结果的保真度分析显示噪声增加，使用不同的统计距离平均增加约20%。结论：本研究提供了一种可用且可扩展的解决方案，以提高异构和动态云环境中量子工作负载执行的效率、成本效益和弹性。获得的这些结果表明，用户应该根据应用程序需求和他们的目标来权衡保真度与成本（和时间）节省的含义。

{"title":"Maximizing quantum hardware utilization via multiprogramming circuits and shot-wise distribution","authors":"Giuseppe Bisicchia , Jaime Alvarado-Valiente , Javier Romero-Álvarez , Jose Garcia-Alonso , Juan M. Murillo , Antonio Brogi","doi":"10.1016/j.infsof.2025.108005","DOIUrl":"10.1016/j.infsof.2025.108005","url":null,"abstract":"<div><h3>Context:</h3><div>Quantum computing is rapidly evolving, offering new opportunities for solving problems in optimization, cryptography, and simulation. However, the limited availability of quantum resources makes efficient utilization of quantum hardware a current challenge. Today’s paradigms often lead to under-utilization of qubits, increased costs, and execution delays, especially in the NISQ era.</div></div><div><h3>Objective:</h3><div>This work aims to improve the utilization of quantum hardware by introducing an execution model that integrates multiprogramming at circuit level with quantum shot-wise distribution in a single policy-driven pipeline.</div></div><div><h3>Methods:</h3><div>An architecture has been implemented that combines circuit scheduling and shot distribution techniques to aggregate multiple circuits and distribute their shots across heterogeneous QPUs. The approach was empirically validated on actual IBM Quantum devices using a diverse set of reference circuits.</div></div><div><h3>Results:</h3><div>The proposal achieved a reduction in cost of 95% and a reduction in tasks 92%. Moreover, the fidelity analysis of the results showed an increase in noise, with an average increase of approximately 20% using different statistical distances.</div></div><div><h3>Conclusions:</h3><div>This research provides a usable and extensible solution to increase the efficiency, cost effectiveness, and resilience of quantum workload execution in heterogeneous and dynamic cloud environments. These results obtained suggest that users should weigh the implications of fidelity versus cost (and time) savings based on the application requirements and their goals.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"191 ","pages":"Article 108005"},"PeriodicalIF":4.3,"publicationDate":"2025-12-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145840127","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A model-driven approach to streamline the development of prescriptive services for digital twins 一种模型驱动的方法，以简化数字孪生的规范性服务的开发

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-20 DOI: 10.1016/j.infsof.2025.108001

Arturo Barriga, José A. Barriga, Pablo A. Portillo, Adolfo Lozano-Tello, Pedro J. Clemente

Context:

Digital twins are dynamic virtual replicas of physical systems that offer significant benefits in terms of efficiency and productivity. In particular, prescriptive digital twins are able to provide specific recommendations to help stakeholders optimize physical system performance, reduce risks, and proactively solve problems. However, despite the high value of prescriptive services, most current digital twin implementations remain focused on monitoring and descriptive analytics, lacking the advanced capabilities required to provide actionable, prescriptive insights.

Objective:

This paper aims to streamline the development of prescriptive services for digital twin systems, thus fostering their adoption and unlocking their full potential.

Methods:

To this end, a Model-Driven Development (MDD) approach specifically designed for prescriptive digital twin services is proposed.

Results:

With the proposed Domain-Specific Language (DSL), developers can focus on designing their prescriptive services from a high-level perspective. Then, Model-to-Text (M2T) transformations generate the required code, configuration files, and deployment artifacts.

Conclusion:

Thus, this approach not only reduces the development time and cost of these services, but also reduces the need for technical expertise. In addition, the applicability of the proposal is validated through two digital twin use cases in the agriculture and manufacturing domains.

背景：数字孪生是物理系统的动态虚拟副本，在效率和生产力方面提供了显著的好处。特别是，规范性数字孪生能够提供具体的建议，以帮助利益相关者优化物理系统性能，降低风险并主动解决问题。然而，尽管规定性服务具有很高的价值，但目前大多数数字孪生实现仍然专注于监控和描述性分析，缺乏提供可操作的规定性见解所需的高级功能。目的：本文旨在简化数字孪生系统规范服务的开发，从而促进其采用并释放其全部潜力。方法：为此，提出了一种专门为规定性数字孪生服务设计的模型驱动开发（MDD）方法。结果：使用建议的领域特定语言（DSL），开发人员可以从高层次的角度专注于设计他们的规定性服务。然后，模型到文本（M2T）转换生成所需的代码、配置文件和部署构件。结论：因此，这种方法不仅减少了这些服务的开发时间和成本，还减少了对技术专门知识的需求。此外，通过农业和制造业领域的两个数字孪生用例验证了该提案的适用性。

{"title":"A model-driven approach to streamline the development of prescriptive services for digital twins","authors":"Arturo Barriga, José A. Barriga, Pablo A. Portillo, Adolfo Lozano-Tello, Pedro J. Clemente","doi":"10.1016/j.infsof.2025.108001","DOIUrl":"10.1016/j.infsof.2025.108001","url":null,"abstract":"<div><h3>Context:</h3><div>Digital twins are dynamic virtual replicas of physical systems that offer significant benefits in terms of efficiency and productivity. In particular, prescriptive digital twins are able to provide specific recommendations to help stakeholders optimize physical system performance, reduce risks, and proactively solve problems. However, despite the high value of prescriptive services, most current digital twin implementations remain focused on monitoring and descriptive analytics, lacking the advanced capabilities required to provide actionable, prescriptive insights.</div></div><div><h3>Objective:</h3><div>This paper aims to streamline the development of prescriptive services for digital twin systems, thus fostering their adoption and unlocking their full potential.</div></div><div><h3>Methods:</h3><div>To this end, a Model-Driven Development (MDD) approach specifically designed for prescriptive digital twin services is proposed.</div></div><div><h3>Results:</h3><div>With the proposed Domain-Specific Language (DSL), developers can focus on designing their prescriptive services from a high-level perspective. Then, Model-to-Text (M2T) transformations generate the required code, configuration files, and deployment artifacts.</div></div><div><h3>Conclusion:</h3><div>Thus, this approach not only reduces the development time and cost of these services, but also reduces the need for technical expertise. In addition, the applicability of the proposal is validated through two digital twin use cases in the agriculture and manufacturing domains.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"191 ","pages":"Article 108001"},"PeriodicalIF":4.3,"publicationDate":"2025-12-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145840299","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

On the use of extended reality to support software development activities: A systematic literature review 关于使用扩展现实来支持软件开发活动：系统的文献回顾

IF 4.3 2区计算机科学 Q2 COMPUTER SCIENCE, INFORMATION SYSTEMS

Information and Software Technology

Pub Date : 2025-12-19 DOI: 10.1016/j.infsof.2025.107999

Tiara Rojas-Stambuk , Juan Pablo Sandoval Alcocer , Leonel Merino , Andres Neyem

Context:

Extended Reality (XR) technologies, including virtual, augmented, and mixed reality, offer novel ways to support software development through immersive and spatial representations of complex software artifacts. Although many XR-based tools have been introduced, their coverage of development activities, types of visualized software data, and evaluation quality remain unclear.

Objectives:

This paper aims to systematically review the use of XR in software development, focusing on the tasks supported, the types of data visualized, the visualization and interaction techniques, the evaluation methods, and the limitations reported.

Methods:

We conducted a systematic review of the literature of 77 primary studies published between 1995 and February 2025. Each study was analyzed and classified according to the supported development tasks, the types of visualized software data, the visualization techniques used, the XR technologies used, the evaluation strategies, and the limitations.

Results:

Our findings show that most XR tools target software comprehension, primarily through structural visualizations. City metaphors and other metaphor-based techniques are the most common. However, XR remains underexplored in activities such as testing, performance analysis, and requirements engineering. Evaluation approaches are heterogeneous, often lacking methodological rigor, sufficient sample sizes, and standardized metrics.

Conclusion:

Although XR holds promise for improving software development, its current use is concentrated in a narrow set of activities and is hampered by limited evaluation quality. The challenges remain in tool integration, interaction design, and practical adoption. We identify key gaps and provide recommendations to guide future research toward broader and more effective use of XR in software engineering.

上下文：扩展现实（XR）技术，包括虚拟现实、增强现实和混合现实，提供了通过复杂软件工件的沉浸式和空间表示来支持软件开发的新方法。尽管已经引入了许多基于xr的工具，但是它们对开发活动、可视化软件数据类型和评估质量的覆盖范围仍然不清楚。目的：本文旨在系统地回顾XR在软件开发中的应用，重点关注支持的任务、可视化数据的类型、可视化和交互技术、评估方法以及报道的局限性。方法：我们对1995年至2025年2月间发表的77篇主要研究文献进行了系统综述。根据支持的开发任务、可视化软件数据的类型、使用的可视化技术、使用的XR技术、评估策略和局限性，对每个研究进行了分析和分类。结果：我们的研究结果表明，大多数XR工具的目标是软件理解，主要是通过结构可视化。城市隐喻和其他基于隐喻的技巧是最常见的。然而，XR在测试、性能分析和需求工程等活动中仍未得到充分的探索。评估方法是异构的，通常缺乏方法的严谨性、足够的样本量和标准化的度量。结论：尽管XR有希望改善软件开发，但它目前的使用集中在一组狭窄的活动中，并且受到有限的评估质量的阻碍。挑战仍然存在于工具集成、交互设计和实际采用方面。我们确定了关键的差距，并提供了建议，以指导未来在软件工程中更广泛、更有效地使用XR的研究。

{"title":"On the use of extended reality to support software development activities: A systematic literature review","authors":"Tiara Rojas-Stambuk , Juan Pablo Sandoval Alcocer , Leonel Merino , Andres Neyem","doi":"10.1016/j.infsof.2025.107999","DOIUrl":"10.1016/j.infsof.2025.107999","url":null,"abstract":"<div><h3>Context:</h3><div>Extended Reality (XR) technologies, including virtual, augmented, and mixed reality, offer novel ways to support software development through immersive and spatial representations of complex software artifacts. Although many XR-based tools have been introduced, their coverage of development activities, types of visualized software data, and evaluation quality remain unclear.</div></div><div><h3>Objectives:</h3><div>This paper aims to systematically review the use of XR in software development, focusing on the tasks supported, the types of data visualized, the visualization and interaction techniques, the evaluation methods, and the limitations reported.</div></div><div><h3>Methods:</h3><div>We conducted a systematic review of the literature of 77 primary studies published between 1995 and February 2025. Each study was analyzed and classified according to the supported development tasks, the types of visualized software data, the visualization techniques used, the XR technologies used, the evaluation strategies, and the limitations.</div></div><div><h3>Results:</h3><div>Our findings show that most XR tools target software comprehension, primarily through structural visualizations. City metaphors and other metaphor-based techniques are the most common. However, XR remains underexplored in activities such as testing, performance analysis, and requirements engineering. Evaluation approaches are heterogeneous, often lacking methodological rigor, sufficient sample sizes, and standardized metrics.</div></div><div><h3>Conclusion:</h3><div>Although XR holds promise for improving software development, its current use is concentrated in a narrow set of activities and is hampered by limited evaluation quality. The challenges remain in tool integration, interaction design, and practical adoption. We identify key gaps and provide recommendations to guide future research toward broader and more effective use of XR in software engineering.</div></div>","PeriodicalId":54983,"journal":{"name":"Information and Software Technology","volume":"191 ","pages":"Article 107999"},"PeriodicalIF":4.3,"publicationDate":"2025-12-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145840129","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0