Search

Today's software industry is global, virtual, and depending more than ever on strong and reliable processes. Stakeholders and infrastructure are distributed across the globe, posing challenges that go beyond those with co‐located teams and servers. Software Engineering continues to be a complex undertaking, with projects challenged to meet expectations, especially regarding costs. We know that Software Engineering is an ever‐changing discipline, with the result that firms and their employees must regularly embrace new methods, tools, technologies, and processes. In 2020, the International Conference on Global Software Engineering (ICGSE) and the International Conference on Systems and Software Processes (ICSSP) joined forces aiming to create a holistic understanding of the software landscape both from the perspective of human and infrastructure distribution and also the processes to support software development. Unfortunately, these challenges have become even more personal to many more in 2020 due to the disruption introduced by the COVID‐19 pandemic, which forced both conferences to be held virtually. As an outcome of the joint event, we selected a set of the best papers from the two conferences, which were invited to submit extended versions to this Special Issue in the Journal of Software: Maintenance and Evolution. Dedicated committees were established to identify the best papers. Eight papers were invited and ultimately, seven of these invited papers have made it into this Special Issue. [ABSTRACT FROM AUTHOR]

The article introduces selected papers from the 12th International Symposium on Web Systems Evolution (WSE 2010) held in Timişoara, Romania, on September 17 and 18, 2010.

This special issue comprises a selected set of high quality and extended articles of the 27th Systems, Software and Services Process Improvement (EuroSPI) Conference, held in 2020 in Düsseldorf, Germany (Figure 1). Automotive software is a relatively new, but important research field [[14]] and these two papers are directing two different but crucial challenges: SPI Implementation practices and the integration of security in the automotive software development lifecycle. EuroSPI is an initiative with the following major action lines http://www.eurospi.net: Establishing an annual EuroSPI conference supported by software process improvement networks from different EU countries. [Extracted from the article]

As a summary of past, current, and future trends in software maintenance and reengineering research, we give in this editorial a retrospective look from the past 14 years to now. We provide insight on how software maintenance has evolved and on the most important research topics presented in the series of the European Conference on Software Maintenance and Reengineering. [ABSTRACT FROM AUTHOR]

Maturity models are widely used in process improvement. The users of a maturity model should be confident that the weak points of the assessed processes can be found, and that the most valuable changes are introduced. Therefore, the evaluation of maturity models is an important activity. In this paper, a mapping study of the literature on the evaluation of maturity models is presented. Two databases are searched resulting in a set of relevant papers. The identified papers can be classified according to six categories, namely the maturity model under evaluation, type of evaluation, relation of the evaluators/authors to the maturity model, level of objectivity, main purpose of the paper, and size of study. Further, a framework of different evaluations of maturity models is developed, and the relevant papers are mapped to the framework. Finally, the relevant research on the evaluation of the maturity models in the Capability Maturity Model family is discussed in more detail. The result of this mapping study is a clear overview of how the evaluation of maturity models has been done, and some discussions are provided for further research on the evaluation of commonly used or newly developed maturity models. [ABSTRACT FROM AUTHOR]

The increased need for constant connectivity and complete automation of existing systems fuels the popularity of Cyber Physical Systems (CPS) worldwide. Increasingly more, these systems are subjected to cyber attacks. In recent years, many major cyber‐attack incidents on CPS have been recorded and, in turn, have been raising concerns in their users' minds. Unlike in traditional IT systems, the complex architecture of CPS consisting of embedded systems integrated with the Internet of Things (IoT) requires rather extensive planning, implementation, and monitoring of security requirements. One crucial step to planning, implementing, and monitoring of these requirements in CPS is the integration of the risk management process in the CPS development life cycle. Existing studies do not clearly portray the extent of damage that the unattended security issues in CPS can cause or have caused, in the incidents recorded. An overview of the possible risk management techniques that could be integrated into the development and maintenance of CPS contributing to improving its security level in its actual environment is missing. In this paper, we are set out to highlight the security requirements and issues specific to CPS that are discussed in scientific literature and to identify the state‐of‐the‐art risk management processes adopted to identify, monitor, and control those security issues in CPS. For that, we conducted a systematic mapping study on the data collected from 312 papers published between 2000 and 2020, focused on the security requirements, challenges, and the risk management processes of CPS. Our work aims to form an overview of the security requirements and risks in CPS today and of those published contributions that have been made until now, towards improving the reliability of CPS. The results of this mapping study reveal (i) integrity authentication and confidentiality as the most targeted security attributes in CPS, (ii) model‐based techniques as the most used risk identification and assessment and management techniques in CPS, (iii) cyber‐security as the most common security risk in CPS, (iv) the notion of "mitigation measures" based on the type of system and the underline internationally recognized standard being the most used risk mitigation technique in CPS, (v) smart grids being the most targeted systems by cyber‐attacks and thus being the most explored domain in CPS literature, and (vi) one of the major limitations, according to the selected literature, concerns the use of the fault trees for fault representation, where there is a possibility of runtime system faults not being accounted for. Finally, the mapping study draws implications for practitioners and researchers based on the findings. [ABSTRACT FROM AUTHOR]

Crowdsourcing is simply the outsourcing of different tasks or work to a diverse group of individuals in an open call for the purpose of utilizing human intelligence. Crowdsourcing nowadays used to support and enhance software engineering in different aspects. In this proposed study, a systematic literature review was conducted for the last 10 years from 2010 to 2019. During the filtering process, a total of 120 relevant studies have been identified, and then the most relevant 70 studies were selected to include as part of the current study. The proposed study shows the effect of task assignment in crowdsourcing, such as if a task is assigned to an appropriate worker or an inappropriate worker, what will be the consequences. The study also highlights crowdsourcing usage in the field of software engineering. All the existing task assignment methods used for assigning the task to make crowdsourcing activity more effective have been analyzed. The study also highlights all the available crowdsourcing platforms used for a variety of task to be performed. The study concludes by identifying the issues regarding the task assignment and to specify the methods for enhancement in the assignment of tasks for future research in crowdsourcing. [ABSTRACT FROM AUTHOR]

An introduction is presented in which the authors discuss various reports within the issue on topics including the characteristics of innovation management based on the experiences of Kolbenschmidt Pierburg AG, improving safety and availability of complex systems, and a contextual model for software-intensive systems development.

This special issue contains a selection of distinguished papers from the 19th Working Conference on Reverse Engineering, held in Kingston, Ontario, Canada on October 15th-18th, 2012. The papers address a variety of topics related to reverse engineering, namely the analysis of execution traces, development of fast and efficient forward static slicing techniques, and mining of software repositories aiming at deriving novel patterns related to reverse engineering activities, such as the migration in Java libraries and the analysis of effects of file editing patterns on source code quality. [ABSTRACT FROM AUTHOR]

The Verein der Deutschen Automobilindustrie (VDA) guidelines used for the interpretation of Automotive SPICE 3.1 contain many rules and recommendations and assessors apply them to check the consistency of ratings in an assessment. The VDA guidelines contain detailed procedures and templates to be used in planning, performing and reporting an assessment. However, an assessment is only a small part compared with the support and effort needed to implement improvements and to establish a company‐wide process improvement programme based on best practices. Whereas the VDA guidelines define the assessment process in detail, the ISO norm ISO/IEC 33014:2013 (Information technology—Process assessment—Guide for process improvement) defines a process improvement process. This paper analyses the ISO/IEC 33014:2013 norm and interprets it for the automotive sector and describes a state of the art improvement strategy typical of the automotive industry. Also, the SOQRATES group experiences about good and bad practices in implementing improvement programmes are shared and mapped onto the SPI manifesto principles. The paper concludes with a recommendation to add an improvement strategy‐related appendix to the VDA guidelines. [ABSTRACT FROM AUTHOR]

The article introduces a selection of papers from the 18th Working Conference on Reverse Engineering held in 2011.

This paper documents the results of the PIM.3 (Process Improvement Management) working group in INTACS (International Assessor Certification Schema) supported by the VDA‐QMC (Verband der Deutschen Automobilindustrie/German Automotive Association–Quality Management Center). INTACS promotes Automotive SPICE, which is an international standard that allows process capability assessment of projects, which implement systems that integrate mechanics, electronics, and software including optionally cybersecurity, functional safety, and machine learning. The paper outlines that for the first time since more than 20 years, the INTACS and VDA‐QMC included a process like PIM.3 Process Improvement Management in the scope for the assessor training. Before that, the assessments focused on the management, engineering, and support processes of series projects, while the improvement management has not been trained or assessed. [ABSTRACT FROM AUTHOR]

Global software development (GSD) refers to developing software with a distributed team spanning multiple locations and time zones. Based on relationships, there are four types of outsourcing: dyadic (one client–one vendor), multi‐vendor (one client–many vendors), co‐sourcing (many clients–one vendor), and complex outsourcing (many clients–many vendors). Compared to the other types of outsourcing contracts, complex outsourcing contracts are the hardest to work on and have the highest risk of project failure. This paper presents a model, the complex outsourcing relationships management model (CORMM), to assist the complex outsourcing stakeholders (both the clients and vendors) in managing their relationships in the context of GSD. This paper aims to develop a CORMM to assist the complex outsourcing relationships management stakeholders in GSD. Also, we are interested in identifying the applicability and effectiveness of the CORMM in the real‐world industry. The research approach follows a structured methodology comprising multiple phases. Initially, it leverages a systematic literature review (SLR) as its primary research method. The second phase involves the validation of the SLR findings via an empirical study. Subsequently, in the third phase, a model is developed. Finally, the proposed research approach is validated by incorporating two industrial case studies to assess the organization's relationship management utilizing the Motorola tool. The case study results show that CORMM can successfully point out relationship management issues in a complex outsourcing context. The feedback received from the participants of both companies indicates several positive and valuable insights about the CORMM and its application in the context of complex outsourcing relationships. The results highlight that CORMM serves as an assessment tool for evaluating an organization's relationship management capability and a means for organizations to enhance their position. Through CORMM, complex outsourcing organizations (many clients–many vendors) can identify strengths and weaknesses in their relationship management practices, enabling targeted improvement efforts. [ABSTRACT FROM AUTHOR]

Organizations creating software commonly utilize software development lifecycles (SDLCs) to structure development activities. Secure development lifecycles (SDLs) integrate into SDLCs, adding security or compliance activities. They are widely used and have been published by industry leaders and in literature. These SDLs, however, were mostly designed before or while cloud services and other hosted solutions became popular. Such offerings widen the provider's responsibilities, as they not only deliver software but operate and decommission it as well. SDLs, however, do not always account for this change. Security maturity models (SMMs) help to assess SDLs and identify improvements by introducing a baseline to compare against. Multiple of these models were created after the advent of hosted solutions and are more recent than commonly referenced SDLs. Recent SMMs and SDLs may therefore support hosted solutions better than older proposals do. This paper compares a set of current and historic SDLs and SMMs in order to review their support for hosted solutions, including how support has changed over time. Security, privacy, and support for small or agile organizations are considered, as all are relevant to hosted solutions. The SDLs analyzed include Microsoft's SDL, McGraw's Touchpoints, the Cisco's SDL, and Stackpole and Oksendahl's SDL2. The SMMs reviewed are OWASP's Software Assurance Maturity Model 2 and DevSecOps Maturity Model. To assess the support for hosted solutions, the security and privacy activities foreseen in each SDLC phase are compared, before organizational compatibility, activity relevance, and efficiency are assessed. The paper further demonstrates how organizations may select and adjust a suitable proposal. The analyzed proposals are found to not sufficiently support hosted solutions: Important SDLC phases, such as solution retirement, are not always sufficiently supported. Agile practices, such as working in sprints, and small organizations are often not sufficiently considered as well. Efficiency is found to vary based on the application context. A clear improvement trend from before the proliferation of hosted solutions cannot be identified. Future work is therefore found to be required. [ABSTRACT FROM AUTHOR]

This paper presents a procedure for and evaluation of using a semantic similarity metric as a loss function for neural source code summarization. Code summarization is the task of writing natural language descriptions of source code. Neural code summarization refers to automated techniques for generating these descriptions using neural networks. Almost all current approaches involve neural networks as either standalone models or as part of a pretrained large language models, for example, GPT, Codex, and LLaMA. Yet almost all also use a categorical cross‐entropy (CCE) loss function for network optimization. Two problems with CCE are that (1) it computes loss over each word prediction one‐at‐a‐time, rather than evaluating a whole sentence, and (2) it requires a perfect prediction, leaving no room for partial credit for synonyms. In this paper, we extend our previous work on semantic similarity metrics to show a procedure for using semantic similarity as a loss function to alleviate this problem, and we evaluate this procedure in several settings in both metrics‐driven and human studies. In essence, we propose to use a semantic similarity metric to calculate loss over the whole output sentence prediction per training batch, rather than just loss for each word. We also propose to combine our loss with CCE for each word, which streamlines the training process compared to baselines. We evaluate our approach over several baselines and report improvement in the vast majority of conditions. [ABSTRACT FROM AUTHOR]

The phenomenon of crossover cooperation and convergence among services has gained increasing attention in the modern service industry. Service boundaries have been expansively stretched into other domains rather than limited to their original domains to achieve value creation, fostering the emergence of crossover services. Consequently, a complex service ecosystem takes shape. However, there is a lack of the convergence‐evolution mechanism of crossover services for the adaptive transformation of service providers' businesses in this context. To address this problem, this paper proposes population‐based and community‐based convergence‐evolution patterns from the ecological perspective. Based on the analysis of these evolution patterns and the driven force of service evolution, we propose an ecology‐oriented evolution analysis method. Furthermore, we devise an automated tool to support the evolution design of crossover service ecosystems. Case studies and evaluation experiments show the feasibility and effectiveness of our proposed method and the corresponding tool. This paper addresses the convergence‐evolution mechanism in the context of crossover service ecosystems, proposing population‐based and community‐based convergence‐evolution patterns. It introduces an ecology‐oriented evolution analysis approach and an automated tool to support the evolution design of crossover service ecosystems. Case studies and evaluations validate the effectiveness of the proposed approach in aiding requirements' analysts in modeling and analyzing crossover service ecosystem evolution, offering valuable insights for crossover service evolution in the modern service industry. [ABSTRACT FROM AUTHOR]

Agile methodologies are sometimes adopted, with the assumption that benefits can be attained by only using a set of best practices, which can sometimes work to a degree. In this paper, a case is discussed where a software‐producing organization of seven teams achieved significant improvements. The goal of the research was to answer two questions: how an already agile organization could improve its performance further and what is the impact of promoting quality aspects? The questions were answered by implementing interventions based on prior literature and data emerging from semi‐structured interviews. The context was an established business with a complex revenue stream structure, meaning the mix of various project/service/product based work rendered the adoption of agile methods a challenge. Action research comprising three rounds of interventions was conducted to improve the organization and its quality culture while enforcing code review practices. Interventions resulted in a significant improvement in quality, as measured by reported defects. Therefore, it is suggested that agile methods are not sufficient on their own to take software business forward unless a quality‐focused culture is simultaneously achieved through a mindset change and organizational structures to enforce quality practices. The paper contributes to research on the managerial practices of software business and agile transformation by providing empirical support to introducing formal quality improvement to the agile mix as a method for practitioners to improve organizations with complex business models and multiple teams. [ABSTRACT FROM AUTHOR]

The volume at hand presents the special issue of the 12th International Conference on Software and Systems Process (ICSSP) 2019, which was held in Montreal, Canada, from May 25 to 26, 2019. ICSSP 2019 is the latest in a series of conferences that have been organized by the International Software and Systems Process Association. In our evolving landscape, many companies are making efforts to move towards new technologies and tools, agile principles, and continuous integration and delivery. In doing so, they find opportunity, flexibility, and strength in evolving towards hybrid processes, which are neither purely traditional nor can count as textbook agile. This special issue focuses on hybrid processes. [ABSTRACT FROM AUTHOR]

Crowdsource software development has become more and more popular in recent years in the software industry. Crowdsourcing is an open‐call technique for outsourcing tasks to a broad and undefined crowd. Crowdsourcing provides numerous advantages including reduced costs, fast project completion, talent identification, diversity of solutions, top‐quality, and access to problem‐solving creativity. Despite of the benefits gained from crowdsourcing, there are numerous issues like lack of experienced workers, lack of confidentiality, copyright issues, software sustainability, and so forth. There is also less focus on the long‐term sustainability of software development because of new ideas emerging in crowdsourcing software development. Furthermore, in literature, lack of guidelines towards sustainable software crowdsourcing is highlighted as one of the limitations in the software standards. This study aims to identify the factors that influence sustainability aspects in crowdsourced software development. We have conducted a systematic literature review for identification of these factors. In this paper, we present findings of the systematic literature review in the form of a list of 11 factors extracted from a sample of 45 finally selected papers. Among these factors, six of the factors are ranked as critical factors. These critical factors are "Lack of coding standard in documentation," "Use of popular programming tools," "Crowd Lack of knowledge and awareness about sustainability," "Energy‐efficient coding," "Lack of awareness about sustainable software engineering practices," and "Lack of coordination/communication between client and crowd." [ABSTRACT FROM AUTHOR]

Mobile application service ecosystems (MASEs) are highly complex systems that involve multiple factors influencing value creation. However, current research on the impact of structural holes (SHs) as an organizational characteristic on value creation in MASE is still insufficient. To address this research gap, this paper proposes a value creation model for MASE and investigates the impact of SH on the value creation of MASE. Moreover, this paper investigates the correlation between SH and diversity, which can facilitate regulating the value creation process in MASE. Finally, we construct a computational experiment, comparing and analyzing how changes in SH affect the value creation of MASE and the correlation between SH and diversity. The findings of this study can be used to induce the evolution of MASE and promote its value maximization. [ABSTRACT FROM AUTHOR]

Agile software development has reached wide adoption in various countries including Turkey, even though from which its original cultural backgrounds differ. In Turkey, many organizations have started to adopt Agile approaches more and more in their software development processes. This interest in the country's software development is parallel to what the academic literature on Agile in the country exhibits. However, despite the prevalence of Agile in Turkey, there is a lack of sufficient secondary research and comprehensive review on Agile in Turkey, which poses a significant necessity for further investigation. Considering this gap, we performed a quantitative bibliometric analysis of Agile software development publications produced by Turkish organizations in a holistic and broad approach both for scholars and practitioners. We provide a summary of relevant academic studies that emerged in Agile research in Turkey by focusing on many aspects including bibliometric properties of papers, researchers, affiliations, venues, and thematic contents that are separated into 15 sub‐research questions. After delivering results based on the questions, we discuss the results and findings of our study and present implications regarding the findings. The main contributions of our work are twofold. First, the paper may help the readers to have a quick idea, understand the subject, and gain insight from a large volume of scientific data. Second, the paper can help readers to use these analyses to form future research. [ABSTRACT FROM AUTHOR]

The objective of this study is to analyze the current perspective as regards knowledge related to what causes stress or motivates developers, how these two aspects are related to each other, and how this in turn affects their performance in the sphere of Global Software Development and how these can be controlled. This paper presents the results obtained after conducting a systematic mapping study of literature in order to analyze how stress, motivation, and performance affect the project members in Global Software Development teams. We carried out a systematic mapping of published studies dealing with stress, motivation, and performance in global software engineering. A total of 118 papers dealing with this subject were found. The literature analyzed provided a relatively significant quantity of data referring to the impact that the characteristics of distributed software development projects have on the performance and productivity of teams, along with the actions taken to improve that performance. However, when focusing on the analysis of the impact of this type of projects on team members' motivation, and on the actions that can be taken to improve that motivation, we discovered that the number of works decreases considerably and that works referring to the impact of this kind of development on developers' stress were virtually non‐existent, as were those concerning ways in which to improve that stress. We are, therefore, of the opinion that it is necessary to carry out in‐depth research into the aspects of working in distributed teams that may have a negative impact on developers' levels of motivation and stress, along with what could be beneficial in order to improve levels of motivation and decrease levels of stress. [ABSTRACT FROM AUTHOR]

The trend toward global software development (GSD) has grown tremendously in recent years because of the rapid acceleration in information and communication technologies (ICTs). The reason for the changing trend toward GSD is to develop high‐quality software with minimum cost and time with round the clock. Despite the benefits gained from GSD, there are certain challenges associated with it. Literature reveals that software integration is an integral challenge in the GSD domain and vendors face numerous difficulties in integrating the software components to build the final product. The main aim of this research study is to develop a software integration model (SIM) that will assist GSD vendors to address the factors linked with various stages of software integration. This model is basically designed for GSD vendor organizations to assess and improve their software integration‐related activities. However, it is also beneficial for GSD client organizations in getting knowledge about the status of the GSD vendor organization's software integration capabilities. The research design is composed of well‐known research strategies including systematic literature review (SLR), questionnaire survey, and case study approach. This research study yielded the SIM. We identified nine critical success factors (CSFs) and 10 critical barriers (CBs) in software integration through SLR‐1 by extracting the data from a sample of 105 papers. Similarly, we also identified a total of 132 practices/solutions, for the identified CSFs and CBs in software integration, through SLR‐2 from a sample of 40 papers. These identified factors and practices were validated from 96 global software industry experts/practitioners through online survey. The identified CSFs, CBs, and their associated practices have been arranged adequately across the six software integration levels of SIM. We have adapted SIM structure from capability maturity model integration (CMMI), implementation maturity model (IMM), and software outsourcing vendors readiness model (SOVRM). We also conducted six case studies in the software industry for SIM applicability and validity. The participants' feedback from the six case studies in GSD vendor's organizations portray that the SIM is beneficial for GSD vendors to assess their software integration capability. [ABSTRACT FROM AUTHOR]

The vulnerabilities in Ethereum virtual machine (EVM) may lead to serious problems for the Ethereum ecosystem. With lots of techniques being developed for the validation of smart contracts, the testing of EVM has not been well‐studied. In this paper, we propose EVMFuzz, the first that uses the differential fuzzing technique to detect vulnerabilities in EVM. The core idea of EVMFuzz is to continuously generate seed contracts for different EVMs' execution, so as to find as many inconsistencies among execution results as possible, and eventually discover vulnerabilities with output cross‐referencing. First, we present the evaluation metric for the internal inconsistency indicator. Then, we construct seed contracts via predefined mutators and employ a dynamic priority scheduling algorithm to guide seed contract selection and maximize the inconsistency. Finally, we leverage different EVMs as cross‐referencing oracles avoiding manual checking. For evaluation, we selected four widely used EVMs for the test, conducted large‐scale mutation on 36,295 real‐world smart contracts, and generated 253,153 smart contracts as initial seeds. Accompanied by manual root cause analysis, we found five previously unknown security bugs and all had been included in the common vulnerabilities and exposures (CVE) database. This paper proposes EVMFuzz, the first that uses the differential fuzzing technique to detect vulnerabilities in Ethereum virtual machine (EVM). EVMFuzz found five previously unknown security bugs in four widely used EVMs, and all had been included in the common vulnerabilities and exposures (CVE) database. [ABSTRACT FROM AUTHOR]

Context: Interest in global software development (GSD) has led to the publication of numerous studies. Over time, these studies should be updated to verify if their findings and conclusions remain valid. Objective: To update a tertiary study, published in 2014, focused on investigating risks and risk mitigation advice in the context of GSD. Method: We conducted a systematic literature study based on forward snowballing, out of which we identified and selected 25 unique studies. Results: We extracted: (a) 118 risks (75 of which already identified in the original work), and (b) 167 mitigation advice (44 of which were identified in the original work). Out of 43 new risks identified, just 10 are specific to GSD settings; the others are risks of the software process described in the context of GSD. The evidence supporting these risks and mitigation were extracted from 619 and 389 primary sources, respectively. Given the amount of evidence found, we have reported only those with higher empirical support. The raw data is available online as complementary material. Conclusions: Interest in GSD, its potential risks, and mitigation strategies, remains high. This update has allowed increasing the level of empirical support provided by the findings of the original work. [ABSTRACT FROM AUTHOR]

With the advent of regulations protecting users such as the General Data Protection Regulation, security and privacy concerns are playing a new role in small settings such as in very small entities. Their relevance is increasing, and privacy is being considered a Troy horse in software developments. In fact, privacy is a part of software architectural decisions, and they must be considered as a technical debt. The contributions of this paper are the following: a privacy debt definition with a principal and an interest, privacy‐related activities to be considered within the ISO/IEC 29110 basic profile, and the use of the net present value within this context. All these contributions help us to integrate privacy debt and VSE's software developments. [ABSTRACT FROM AUTHOR]

For this paper, we have identified a list of 32 characteristic symptoms that is often discussed during assessments, generated by two experienced assessors who had undertaken maturity assessments in more than 300 companies. We then use cognitive mapping and the "five whys" technique to look beyond the symptoms and reveal the underlying problems or causes of the problems. Following that, we evaluate our findings through the design and evaluation of a web‐based tool where users can score statements based on a formulation of the symptoms. This enables us to recommend to users the areas where they probably need to improve. We designed the tool in three learning cycles of design evaluation and ended up in a summative evaluation where we compared the outcome of using the website tool with a CMMI maturity assessment. We conclude that a systematic quest for symptoms coupled with scoring statements based on the symptoms can point to improvement areas. However, we conclude that doing so is no substitute for a maturity assessment; the scoring of statements cannot reveal the maturity of the organization, but it can quickly and easily point in a useful direction and provide recommendations for going in that direction. [ABSTRACT FROM AUTHOR]

This article presents a systematic mapping study on the model‐driven engineering of safety and security concerns in software systems. Combined modeling and development of both safety and security concerns is an emerging field of research as both concerns affect one another in unique ways. Our mapping study provides an overview of the current state of the art in this field. This study carefully selected 143 publications out of 27,259 relevant papers through a rigorous and systematic process. This study then proposes and answers questions such as frequently used methods and tools and development stages where these concerns are typically investigated in application domains. Additionally, we identify the community's preference for publication venues and trends. The discussion on obtained results also features the gained insights and future research directions. [ABSTRACT FROM AUTHOR]

This paper proposes a unified formal framework, Formal Framework For FLUID (F3FLUID), for the development of safety‐critical interactive systems. This framework is based on the Formal Language of User Interface Design (FLUID) pivot modeling language defined in the FORMEDICIS project, which enables high‐level system requirements for interactive systems to be specified in the FLUID language. This modeling language is specifically designed for handling concepts of safety‐critical interactive systems, including domain knowledge. A FLUID model is used as a source model for the generation of several target models in different modeling languages to support the formal verification methods, such as theorem proving and model checking. In this paper, we use the Event‐B modeling language for checking functional behaviors, user interactions, safety properties, and domain properties. A FLUID model is transformed into an Event‐B model, and then, the Rodin tool is used to check the internal consistency with respect to the given safety properties. We illustrate the operational semantics of the FLUID language, and the transformation strategy of FLUID models into Event‐B models, including the tool development. We use the ProB model checker to analyze the temporal properties and to animate the formalized specification. In addition, an interactive cooperative objects (ICOs) model is derived from the Event‐B model for animation, visualization and validation of dynamic behaviors, visual properties, and task analysis. Finally, an industrial case study, complying with the ARINC 661 standard, Multi‐Purpose Interactive Applications (MPIA), is used to illustrate the effectiveness of our F3FLUID framework for the development of safety‐critical interactive systems. [ABSTRACT FROM AUTHOR]

Quality of research and knowledge sources can be a critical factor to judge the quality of the research citing them. The prevailing online dissemination of research via blogs, websites, experience reports, and white papers can be helpful as it minimizes potential publication biases. In this paper, we have (i) identified the body of software engineering (SE) literature that is non‐indexed by Web‐of‐Science but has been used in published SE systematic literature review (SLR) studies (as primary studies); (ii) proposed a checklist‐based method for quality assessment of non‐indexed and grey literature; (iii) empirically evaluated the effectiveness of the proposed method; (iv) searched primary studies retrieved from the SLRs in DBLP and Google Scholar (GS) to verify whether DBLP or Google Scholar can act as viable options to search for non‐indexed Web‐of‐Science (non‐WOS‐indexed) literature. Besides proposing our synthesized checklist method, we found that (i) SE literature reviews use significantly non‐indexed Web‐of‐Science sources; (ii) DBLP only covers a portion of the non‐WOS‐indexed reference, whereas GS has a more complete coverage of the non‐indexed reference in comparison. Preliminary evaluation of the proposed quality assessment point system‐based and checklist‐based methods shows it to be a viable way to assess quality of the non‐indexed and grey literature. [ABSTRACT FROM AUTHOR]

However, if on the one side it is now generally accepted that disciplined procedures and quality standards should be applied in production code development, on the other side, comparable levels of rigor and quality are not demanded for the code written for testing that production code. Recently, both researchers and practitioners have proposed solutions toward this problem by identifying test code smells or test code quality issues and providing techniques to automatically detect and repair test code bugs and flakiness. We are pleased to present the papers selected for inclusion in the special issue devoted to the 1st International Conference on Automation of Software Test, which was held virtually in colocation with the 42nd IEEE/ACM International Conference on Software Engineering (ICSE 2020). [Extracted from the article]

Agile practices have received attention from industry as an alternative to plan-driven software development approaches. Agile encourages, for example, small self-organized collocated teams, whereas global software engineering (GSE) implies distribution across cultural, temporal, and geographical boundaries. Hence, combining them is a challenge. A systematic review was conducted to capture the status of combining agility with GSE. The results were limited to peer-reviewed conference papers or journal articles, published between 1999 and 2009. The synthesis was made through classifying the papers into different categories (e.g. publication year, contribution type, research method). At the end, 81 papers were judged as primary for further analysis. The distribution of papers over the years indicated that GSE and Agile in combination has received more attention in the last 5 years. However, the majority of the existing research is industrial experience reports in which Agile practices were modified with respect to the context and situational requirements. The emergent need in this research area is suggested to be developing a framework that considers various factors from different perspectives when incorporating Agile in GSE. Practitioners may use it as a decision-making basis in early phases of software development. [ABSTRACT FROM AUTHOR]

Internet of Health Things (IoHT) is an extension of the Internet of Things (IoT), which plays an important role in the observation, consultation, monitoring, and treatment process of remote exchange data processes in healthcare. The integration, computation, and interoperability are facilitated through various sensors, controllers, and actuators. Security is considered as one of the important factors for the communication of these devices to smoothly run the activities of healthcare. The current literature associated to the security of IoHT cover diverse aspects, though there is dire need of the knowledge, which can thoroughly show the review of current state‐of‐the‐art work in a systematic way. To overcome this limitation, the planned study offerings a systematic literature review (SLR) for the IoHT security and provenance. This review will support researchers to take benefit from the present literature and devise novel solutions considering the current study as evidence in IoHT. This paper focused on the security analysis and provenance for the IoHT and answering the defined questions in the current study. [ABSTRACT FROM AUTHOR]

The article presents an introduction to the special issue of the 9th International Conference on Software and Systems Process (ICSSP) 2016, which was held in Austin, Texas, from May 14 to 15, 2016. It is noted that ICSSP 2016 panel entitled "Process in Action" was moderated by professor Leon Osterweil to discuss current challenges in process evolution and application in real-world.

Developers are encouraged to adopt good design practices to maintain good software quality during the system's evolution. However, some modifications and changes to the system could cause code smells and pattern grime, which might incur more maintenance effort. As the presence of both code smells and pattern grime is considered a bad sign and raises a flag at code segments that need more careful examination, a potential connection between them may exist. Therefore, the main objective of this paper is to (1) empirically investigate the potential relationship between the accumulation of pattern grime and the presence of code smells and (2) evaluate the significance of individual code smells when they appear in a specific pattern grime category. To achieve this goal, we performed an empirical study using six‐grime metrics and 10 code smells on five Java open‐source projects ranging from 217 to 563 classes. Our statistical results indicate that, in general, the growth of grime is more likely to co‐occur with code smells using Spearman's correlation and Odd Ratio test. Specifically, there is a strong positive association between the growth of pattern grime at the class level and the presence of Shotgun Surgery smell according to the result of applying the Apriori algorithm, which gives conviction values equal to 1.66. The findings in this paper are helpful for developers and researchers as the presence of pattern grime could be considered a factor in improving the performance of existing smell detection methods. Furthermore, the link between grime and smells can be exploited as a hint for smell distribution in the system. [ABSTRACT FROM AUTHOR]

In software engineering, technical debt (TD) has been widely investigated, but debt regarding social issues, people, and processes has not been explored as much. It should be noted here that we use nontechnical debt (NTD) as an umbrella term to cover social, process, and people debts. Although the number of studies on NTD in software is increasing, the majority of them are descriptive rather than rigorous, and there is no systematic development of cumulative knowledge. As a result, identifying the fundamental causes of NTD and the associated mitigation techniques in software engineering is challenging. Therefore, this study investigates the scientific evidence regarding NTD till date by conducting a systematic mapping review of software engineering research between January 2000 and October 2021. The search strategy resulted in 175 studies, 17 of which were identified as unique and relevant primary papers. The primary studies show that NTD and TD are inextricably linked. In addition, this study also captured a plethora of causes and mitigation strategies for managing NTD and thus makes four important contributions: (i) highlighting state‐of‐the‐art NTD research; (ii) identification of the reported causes and mitigation strategies in the primary papers; and (iii) determination of opportunities for future NTD research. [ABSTRACT FROM AUTHOR]

Companies often claim to follow specific software development methodologies (SDM) when performing their software development process. These methodologies are often supported by dedicated tools that keep track of work activities carried out by developers. The purpose of this paper is to provide a novel approach that integrates analytical insights from both the perceptions of SDM stakeholders and software development tools logs to provide SDM improvement recommendations. This paper develops a new process improvement approach that combines two significantly different sources of data on the same phenomenon. First, it uses a questionnaire to gather software development stakeholder SDM perceptions (managers and developers). Second, it leverages process mining to analyze software development tools logs to obtain additional information on software development activities. Finally, it develops recommendations based on concurrent analysis of both sources. Our novel process improvement approach is evaluated in three directions: Does the presented approach (RQ1) enable managers to gain additional insights into employees' performance, (RQ2) deliver additional insights into project performance, and (RQ3) enable development of additional SDM improvement recommendations? We find that integrated analysis of software development perception data and software development tools logs opens new possibilities to more precisely identify and improve specific SDM elements. The evaluation of our novel process improvement approach follows a single case study design. Our approach can only be used in enterprises in which software development tools logs are available. The study should be repeated in different cultural settings. We practically show how concurrently analyzing data about developer SDM perceptions and event log data from software development tools enables management to gain additional insights in the software development process regarding the performance of individual developers. The main theoretical contribution of our paper is a novel process improvement approach that effectively integrates data from management and developer perspectives and software development tools logs. [ABSTRACT FROM AUTHOR]

An introduction to the journal is presented in which the editor discusses software process improvement.

Software is an integrated part of new features within the automotive sector, car manufacturers, the Hersteller Initiative Software (HIS) consortium defined metrics to determine software quality. Yet, problems with assigning metrics to quality attributes often occur in practice. The specified boundary values lead to discussions between contractors and clients as different standards and metric sets are used. This paper studies metrics used in the automotive sector and the quality attributes they address. The HIS, ISO/IEC 25010:2011, and ISO/IEC 26262:2018 are utilized to draw a big picture illustrating (i) which metrics and boundary values are reported in literature, (ii) how the metrics match the standards, (iii) which quality attributes are addressed, and (iv) how the metrics are supported by tools. Our findings from analyzing 38 papers include a catalog of 112 metrics of which 17 define boundary values and 48 are supported by tools. Most of the metrics are concerned with source code, are generic, and not specifically designed for automotive software development. We conclude that many metrics exist, but a clear definition of the metrics' context, notably regarding the construction of flexible and efficient measurement suites, is missing. [ABSTRACT FROM AUTHOR]

An introduction to the journal is presented which includes articles on topics including service architecture supporting the car‐to‐car and car‐to‐cloud communication, software quality model for a research‐driven organization and qualitative safety analysis of a hemodialysis machine.

The article discusses various reports published within the issue including one on agile coaching for software development and another on systematic approach to tailoring organizational processes.

Automated testing in DevOps represents a key factor for providing fast release of new software features assuring quality delivery. In this paper, we introduce DOXAT, an automated framework for continuous development and testing of access control mechanisms based on the XACML standard. It leverages mutation analysis for the selection and assessment of the test strategies and provides automated facilities for test oracle definition, test execution, and results analysis, in order to speedup and automate the Plan, Code, Build, and Test phases of DevOps process. We show the usage of the framework during the planning and testing phases of the software development cycle of a PDP example. [ABSTRACT FROM AUTHOR]

Software maintenance is an important phase in the software development life cycle. Software projects maintain bug repositories to gather, organize, and keep track of bug reports. These bug reports are resolved by numerous software developers. Whenever the reported bug does not get resolved by the assigned developer, he marks the resolution of bug report as Non‐Reproducible (NR). When NR bugs are reconsidered, few of them get resolved, and their resolution changes from NR to fix (NRF). The main aim of this paper is to predict these fixable NRF bug reports. A major challenge in predicting NRF bugs from NR bugs is that only a small portion of NR bugs get fixed, i.e., class‐imbalance problem. For example, NRF bugs account for only 8.64%, 4.73 %, 4.56%, and 1.06% in NetBeans, Eclipse, Open Office, and Mozilla Firefox projects respectively. In this paper, we work on improving the classification performance on these imbalanced datasets. We propose IMNRFixer, a novel and hybrid NRF prediction tool. IMNRFixer uses three different techniques to combat class‐imbalance problem: undersampling, oversampling, and ensemble models. We evaluate the performance of IMNRFixer models on four large and open‐source projects of Bugzilla repository. Our results show that IMNRFixer outperforms conventional machine learning techniques. IMNRFixer achieves performance up to 71.7%, 93.1%, 91.7%, and 96.5% while predicting the minority class (NRF) for NetBeans, Eclipse, Open Office, and Mozilla Firefox projects, respectively. [ABSTRACT FROM AUTHOR]

The performance of large‐scale systems must be thoroughly tested under various levels of workload, as load‐related issues can have a disastrous impact on the system. However, load testing often requires a large amount of time, running from hours to even days. In our prior work, we reduced the execution time of a load test by detecting repetitiveness in individual performance metric values, such as CPU utilization, that are observed during the test. However, as we explain in this paper, disregarding combinations of performance metrics may miss important information about the load‐related behavior of a system. In this paper we revisit our prior approach, by proposing an approach that reduces the execution time of a load test by detecting whether a test no longer exercises new combinations of the observed performance metrics. We study three open source systems, in which we use our new and prior approaches to reduce the execution time of a 24‐hour load test. We show that our new approach is capable of reducing the execution time of the test to less than 8.5 hours, while preserving a coverage of at least 95% of the combinations that are observed between the performance metrics during the 24‐hour tests. [ABSTRACT FROM AUTHOR]

Regression testing is challenging because of its complexity and the amount of effort and time it requires, especially in large‐scale environments with continuous integration and delivery. Regression test selection and prioritization techniques have been proposed in the literature to address the regression testing challenges, but adoption rates of these techniques in industry are not encouraging. One of the possible reasons could be the disparity in the regression testing goals in industry and literature. This work compares the research perspective to industry practice on regression testing goals, corresponding information needs, and metrics required to evaluate these goals. We have conducted a literature review of 44 research papers and a survey with 56 testing practitioners. The survey comprises 11 interviews and 45 responses to an online questionnaire. We identified that industry and research accentuate different regression testing goals. For instance, the literature emphasizes increasing the fault detection rates of test suites and early identification of critical faults. In contrast, the practitioners' focus is on test suite maintenance, controlled fault slippage, and awareness of changes. Similarly, the literature suggests maintaining information needs from test case execution histories to evaluate regression testing techniques based on various metrics, whereas, at large, the practitioners do not use the metrics suggested in the literature. To bridge the research and practice gap, based on the literature and survey findings, we have created a goal–question–metric (GQM) model that maps the regression testing goals, associated information needs, and metrics from both perspectives. The GQM model can guide researchers in proposing new techniques closer to industry contexts. Practitioners can benefit from information needs and metrics presented in the literature and can use GQM as a tool to follow their regression testing goals. [ABSTRACT FROM AUTHOR]

The volume at hand presents the Special Issue on "Distributed Complex Systems: Governance, Engineering, and Maintenance". The Special Issue has been originally conceived within the context of the 2nd International Workshop on Governing Adaptive and Unplanned Systems of Systems (GAUSS 2020), one of the co‐located events of the 31st International Symposium on Software Reliability Engineering (ISSRE 2020). The authors of the best papers at GAUSS 2020 have been invited to submit an extended version of their previous work. In addition, the editors opened the submission also to all the other researches working on technical and managerial solution for governing Distributed Complex Systems. Ultimate objective of the editors with this Special Issue is to promote discussions focusing on anticipating, mitigating, or reacting to scenarios that were unplanned or under‐specified at design time. This open Special Issue collects both invited contributions from the 2nd International Workshop GAUSS 2020, co‐located with ISSRE 2020, and works from the whole research community. The Special Issue collects eight valuable research articles: four from GAUSS and four from the open call. Overall, the addressed topics span from the design, the development, the validation, and the continuous maintenance of distributed complex systems. [ABSTRACT FROM AUTHOR]

Introduction: Technology transfer aims at supporting the transfer of results from software engineering research from academia to industrial application. Objective: This paper reports on the current state of technology transfer in software engineering. Method: We conducted a systematic literature review, in which we investigated 3070 papers. We identified in total 70 relevant papers, which were subject of a detailed analysis. Results: Many different approaches are proposed to foster technology transfer in software engineering. The majority of these approaches suggest direct collaboration between industry and academia or teaching new technologies in industrial training or university education. In addition, a considerable number of experience reports on technology transfer exist. Hence, a multitude of best practices, success stories, and lessons learned is reported. Among others, empirical evidence, maturity, and adaptability of the technology seem important preconditions for successful transfer, while social and organizational factors seem important barriers to successful technology transfer. Conclusion: Our findings can aid software engineering researchers in determining how best to support the transfer of their research results into practice. Furthermore, analysis of the literature also revealed that no reports exist on the combination of various technology transfer approaches, which could increase advantages of existing approaches while reducing their disadvantages. Technology transfer aims at supporting the transfer of results from software engineering research from academia to industrial application. Results from a systematic literature review of technology transfer research in software engineering show a variety of suggested transfer approaches and point to success factors and barriers for technology transfer in software engineering. Our findings aid software engineering researcher in determining how best to support the transfer of their research results into practice. [ABSTRACT FROM AUTHOR]

This paper proposes an interdisciplinary approach aimed to bring into practice some novel Software Engineering theoretical paradigms. The premise of these news paradigms is based on the idea of "ecologies" as realities that take place in the environment of a Software product. These "ecologies" are understood as tight but flexible interactions between the human, social, and technical components involved, where Software is just another component. However, the theoretical paradigms discussed do not offer a viable way to make sense of these ecologies into the practice of Software design and development. Thus, as a more operationalized approach, this paper proposes a framework based on Networks of Activities, a concept derived from Activity Theory, as a resource to help in the design, development, and evolution of these new emergent complex socio‐technical ecologies. This framework has been conceived as a tool for the design, capture, and, especially, to analyze the evolution of these ecologies. The concepts and notations used by the proposed approach are illustrated through a proof of concept that shows the essential ideas and their use in real scenarios. In this way, the concepts discussed contribute to the improvement of related fields like Requirements Engineering, Human‐Computer Interaction, or Software Architecture, among others. [ABSTRACT FROM AUTHOR]

Due to its development agility, continuous delivery, scalability and other characteristics, the microservice architecture systems (MASs) have provided complex business functions to hundreds of millions of users in many application fields. The operation and maintenance governance for a large number of microservices with complex relationships is crucial to ensuring the stability and reliability of an MAS. Although this research field has received certain attention and produced some innovative results, there is a lack of systematic reviews covering the different aspects of it. In this context, the central objective of this study is to carry out a systematic literature review (SLR) in this field, in an attempt to review existing issues, discuss the main trends, and share the findings with the academia. As a result, we start from more than 500 scientific papers published from 2009 to 2021 and extract 144 most significant papers, identify that the main research directions of this field include load balancing, fault detection, and autoscaling. Subsequently, we provide a comprehensive description of these research directions, discuss them in particular detail. We also determine limitations of current work and discuss new directions worth exploring in the future. Consequently, the outcomes will assist professionals and experts in the industry as well as academic researchers to focus more on operation and maintenance governance of MASs and further improve the relevant methods and theoretical systems in this field. The review designs an effective review research scheme as shown in the figure and starts from more than 500 scientific papers published from 2009 to 2021 and extracts 139 most significant papers, identifying that the main research directions of this field of MASs include load balancing, fault detection, and autoscaling. Subsequently, we provide a comprehensive description of these research directions and discuss them in particular detail. We also determine limitations of current work and discuss new directions worth exploring in the future. [ABSTRACT FROM AUTHOR]

Healthcare systems face various issues related to complex networks of intermediaries and a lack of transaction traceability. The most critical issues are the fragmentation of healthcare data, obstacles in providing efficient research and services, lack of clinical trial reporting, high cost and mismanagement of the drug supply chain, patient data security, and fake drugs. Blockchain technology has the potential to address these criticalities as it has in build traceability mechanisms and promises new business models by enabling incentive structures. This potential of blockchain gathers a high interest in the health industry. However, the implementation of blockchain in healthcare faces various issues as well. Currently, there are no practice‐oriented maturity models to improve such an implementation. In this paper, we present a roadmap to develop a maturity model for blockchain in healthcare (MMBH) based on critical barriers (CBs), critical success factors (CSFs), and the best practices for blockchain implementation in healthcare systems. As a first step to develop the MMBH, in this paper, we present the initial results of a systematic literature review (SLR) to identify critical success factors for implementing blockchain in healthcare systems. We also applied fuzzy technique order preference by similarity to ideal solution (TOPSIS) to prioritize the identified CSFs. [ABSTRACT FROM AUTHOR]